{
  "type": "URL",
  "indicator": "https://blog.hispasec.com/virustotal/rss20.xml",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://blog.hispasec.com/virustotal/rss20.xml",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4134513495,
      "indicator": "https://blog.hispasec.com/virustotal/rss20.xml",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "69f47e886aac3dce3a958d27",
          "name": "2011: Malware Analysis Report",
          "description": "",
          "modified": "2026-05-01T10:20:56.666000",
          "created": "2026-05-01T10:20:56.666000",
          "tags": [],
          "references": [
            "2011-03-11 - Trojan.Koredos Comes with an Unwelcomed Surprise.pdf",
            "2011-01-20 - Beschreibung des Virus Backdoor.Win32. Buterat.afj.pdf",
            "2011-03-08 - Worm-Win32-Yimfoca.A.pdf",
            "2011-03-02 - TDL4 and Glupteba- Piggyback PiggyBugs.pdf",
            "2011-04-26 - SpyEye Targets Opera, Google Chrome Users.pdf",
            "2011-03-28 - Microsoft Hunting Rustock Controllers.pdf",
            "2011-01-09 - Jan 6 CVE-2010-3333 DOC with info theft trojan from the American Chamber of Commerce.pdf",
            "2011-04-19 - TDSS part 1- The x64 Dollar Question.pdf",
            "2011-04-16 - Troj-Sasfis-O.pdf",
            "2011-05-19 - Win32-Expiro.pdf",
            "2011-06-22 - Criminals gain control over Mac with BackDoor.Olyx.pdf",
            "2011-04-30 - BKA-Trojaner (Ransomware).pdf",
            "2011-06-29 - Inside a Back Door Attack.pdf",
            "2011-07-26 - SpyEye Trojan defeating online banking defenses.pdf",
            "2011-04-28 - Un observateur d\u2019\u00e9v\u00e9nements aveugle\u2026.pdf",
            "2011-07-08 - Trojan.Mayachok.2- ?????? ??????? ?????????? VBR-???????.pdf",
            "2011-07-14 - Cycbot- Ready to Ride.pdf",
            "2011-07-06 - Cybercriminals switch from MBR to NTFS.pdf",
            "2011-07-28 - Trojan Tricks Victims Into Transferring Funds.pdf",
            "2011-08-27 - Morto.A.pdf",
            "2011-01-30 - GpCode Ransomware 2010 Simple Analysis.pdf",
            "2011-08-03 - HTran and the Advanced Persistent Threat.pdf",
            "2011-08-28 - Windows Remote Desktop Worm -Morto- Spreading.pdf",
            "2011-09-09 - BIOS Threat is Showing up Again!.pdf",
            "2011-09-02 - ZeuS Gets Another Update.pdf",
            "2011-08-24 - Ice IX, the first crimeware based on the leaked ZeuS sources.pdf",
            "2011-09-13 - Mebromi- the first BIOS rootkit in the wild.pdf",
            "2011-08-04 - Analysis of ngrBot.pdf",
            "2011-09-14 - Ice IX- not cool at all.pdf",
            "2011-09-14 - Malware burrows deep into computer BIOS to escape AV.pdf",
            "2011-09-19 - Mebromi BIOS rootkit affecting Award BIOS (aka -BMW- virus).pdf",
            "2011-08-28 - Windows Remote Desktop Worm -Morto- Spreading22.pdf",
            "2011-09-21 - Sept 21 Greedy Shylock - financial malware.pdf",
            "2011-09-09 - Stuxnet Malware Analysis Paper.pdf",
            "2011-09-27 - Debugging Injected Code with IDA Pro.pdf",
            "2011-10-07 - Rustock samples and analysis links. Rustock.C, E, I, J and other variants.pdf",
            "2011-10-14 - A Detailed Analysis of an Advanced Persistent Threat Malware.pdf",
            "2011-10-06 - ZeuS-in-the-Mobile \u2013 Facts and Theories.pdf",
            "2011-10-08 - Possible Governmental Backdoor Found (-Case R2D2-).pdf",
            "2011-10-17 - W32-Yunsip!tr.pws.pdf",
            "2011-10-06 - Sep 28 CVE-2010-3333 Manuscript with Taidoor (Trojan.Matryoshka by CyberESI).pdf",
            "2011-10-13 - A Detailed Analysis of an Advanced Persistent Threat Malware.pdf",
            "2011-10-31 - The Significance of the -Nitro- Attacks.pdf",
            "2011-10-26 - Tsunami Backdoor Can Be Used for Denial of Service Attacks.pdf",
            "2011-12-20 - Analyzing CVE-2011-4369 \u2013 Part One.pdf",
            "2011-12-08 - The Sykipot Attacks.pdf",
            "2011-12-11 - Intro. To Reversing - W32Pinkslipbot.pdf",
            "Duqu Trojan Questions and Answers.pdf",
            "Palebot trojan.pdf",
            "HTran.pdf",
            "Ghost RAT- Many faces.pdf",
            "Operation Shady Rat.pdf",
            "Alleged APT Intrusion Set 1.php Group.pdf",
            "Stuxnet , Duqu - The Evolution of Drivers.pdf",
            "The RSA Hack.pdf",
            "The Nitro Attacks - Stealing secrets from the Chemical Industry.pdf",
            "Global_Energy_Cyberattacks_-_Night_Dragon_.pdf",
            "The LURID Downloader.pdf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "kikinumpav",
            "id": "385742",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1031,
            "domain": 435,
            "CVE": 13,
            "FileHash-MD5": 155,
            "FileHash-SHA1": 8,
            "FileHash-SHA256": 234,
            "IPv4": 88,
            "email": 9,
            "hostname": 1031
          },
          "indicator_count": 3004,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 12,
          "modified_text": "29 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68d3caa9524bb6b5460615f3",
          "name": "Legacy.Trojan affects threat researchers networks & portals and/or  platforms",
          "description": "Legacy.Trojan affects threat researchers networks & portals and/or platforms or via platforms as a medium.\n[otx auto populated: Adversaries may be able to gain access to a victim's network through a range of techniques, as well as using a variety of other techniques to evade detection and detection.]\n#honeypot #capture #advesaries #fireeye #github",
          "modified": "2025-10-24T10:01:25.310000",
          "created": "2025-09-24T10:40:40.987000",
          "tags": [
            "text drag",
            "browse to",
            "select file",
            "or drop",
            "yara detections",
            "runlevel",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "inject",
            "stncphpphp more",
            "virustotal api",
            "comments",
            "related tags",
            "passive dns",
            "republic",
            "ipv4 add",
            "location korea",
            "korea",
            "asn as9318",
            "dns resolutions",
            "pulses otx",
            "close",
            "dynamicloader",
            "backdoor",
            "tgt session",
            "reads",
            "dynamic",
            "write",
            "chopper",
            "pho exploit",
            "backdoor",
            "fireeye",
            "low risk",
            "drop",
            "create snapshot",
            "hangover_appinbot",
            "kns dropper",
            "self",
            "md5 sha256",
            "google safe",
            "browsing",
            "server response",
            "response code",
            "vary",
            "mimikatz",
            "silence malware",
            "trojanagent",
            "legacy",
            "password",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "initial access",
            "defense evasion",
            "spawns",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "selection",
            "ascii text",
            "crlf line",
            "windir",
            "openurl c",
            "appearance code",
            "password",
            "urlhttps",
            "username",
            "flag",
            "united",
            "markmonitor",
            "github",
            "server",
            "date",
            "click",
            "apt 1",
            "high",
            "read c",
            "search",
            "medium",
            "show",
            "windows",
            "cmd c",
            "ms windows",
            "next",
            "copy",
            "ver",
            "businesseconomy"
          ],
          "references": [
            "Files",
            "Yara : KINS_dropper ,  apt_win_mutex_apt1 ,  Hangover_Fuddol ,   Hangover_Tymtin_Degrab",
            "Yara:  Hangover_Smackdown_various ,  Hangover_Foler  ,  Hangover_UpdateEx ,",
            "Yara: Hangover_Smackdown_Downloader ,  Hangover_Vacrhan_Downloader",
            "Yara: HKTL_NATBypass_Dec22_1 ,  power_pe_injection ,  Mimikatz_Logfile",
            "Yara: Mimikatz_Strings ,  Silence_malware_2 ,  EquationGroup_elgingamble ,  EquationGroup_cmsd",
            "Yara: EquationGroup_ebbshave ,  EquationGroup_eggbasket ,  EquationGroup_sambal",
            "Yara: Mimikatz_Logfile SID : * NTLM : Authentication Id : wdigest : Mimikatz_Strings sekurlsa::logonpasswords"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Ireland"
          ],
          "malware_families": [
            {
              "id": "Php.Exploit.C99-27",
              "display_name": "Php.Exploit.C99-27",
              "target": null
            },
            {
              "id": "Backdoor:ASP/Chopper.F!dha",
              "display_name": "Backdoor:ASP/Chopper.F!dha",
              "target": "/malware/Backdoor:ASP/Chopper.F!dha"
            },
            {
              "id": "Legacy.Trojan.Agent-37025",
              "display_name": "Legacy.Trojan.Agent-37025",
              "target": null
            },
            {
              "id": "Ver",
              "display_name": "Ver",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1110.001",
              "name": "Password Guessing",
              "display_name": "T1110.001 - Password Guessing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1459",
              "name": "Device Unlock Code Guessing or Brute Force",
              "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 87,
            "FileHash-SHA1": 84,
            "FileHash-SHA256": 1049,
            "URL": 1688,
            "hostname": 544,
            "email": 5,
            "domain": 292,
            "CVE": 2
          },
          "indicator_count": 3751,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "218 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Yara: Hangover_Smackdown_Downloader ,  Hangover_Vacrhan_Downloader",
        "2011-04-26 - SpyEye Targets Opera, Google Chrome Users.pdf",
        "2011-07-08 - Trojan.Mayachok.2- ?????? ??????? ?????????? VBR-???????.pdf",
        "2011-10-14 - A Detailed Analysis of an Advanced Persistent Threat Malware.pdf",
        "2011-05-19 - Win32-Expiro.pdf",
        "Yara:  Hangover_Smackdown_various ,  Hangover_Foler  ,  Hangover_UpdateEx ,",
        "Yara: Mimikatz_Strings ,  Silence_malware_2 ,  EquationGroup_elgingamble ,  EquationGroup_cmsd",
        "2011-08-27 - Morto.A.pdf",
        "2011-08-28 - Windows Remote Desktop Worm -Morto- Spreading22.pdf",
        "2011-03-02 - TDL4 and Glupteba- Piggyback PiggyBugs.pdf",
        "2011-09-14 - Malware burrows deep into computer BIOS to escape AV.pdf",
        "2011-10-07 - Rustock samples and analysis links. Rustock.C, E, I, J and other variants.pdf",
        "2011-08-04 - Analysis of ngrBot.pdf",
        "Yara: EquationGroup_ebbshave ,  EquationGroup_eggbasket ,  EquationGroup_sambal",
        "2011-10-31 - The Significance of the -Nitro- Attacks.pdf",
        "Files",
        "2011-08-03 - HTran and the Advanced Persistent Threat.pdf",
        "Yara: Mimikatz_Logfile SID : * NTLM : Authentication Id : wdigest : Mimikatz_Strings sekurlsa::logonpasswords",
        "2011-09-19 - Mebromi BIOS rootkit affecting Award BIOS (aka -BMW- virus).pdf",
        "2011-07-28 - Trojan Tricks Victims Into Transferring Funds.pdf",
        "HTran.pdf",
        "Operation Shady Rat.pdf",
        "2011-12-11 - Intro. To Reversing - W32Pinkslipbot.pdf",
        "2011-04-30 - BKA-Trojaner (Ransomware).pdf",
        "Global_Energy_Cyberattacks_-_Night_Dragon_.pdf",
        "2011-09-09 - BIOS Threat is Showing up Again!.pdf",
        "2011-12-20 - Analyzing CVE-2011-4369 \u2013 Part One.pdf",
        "2011-04-28 - Un observateur d\u2019\u00e9v\u00e9nements aveugle\u2026.pdf",
        "2011-10-06 - Sep 28 CVE-2010-3333 Manuscript with Taidoor (Trojan.Matryoshka by CyberESI).pdf",
        "Yara : KINS_dropper ,  apt_win_mutex_apt1 ,  Hangover_Fuddol ,   Hangover_Tymtin_Degrab",
        "2011-09-14 - Ice IX- not cool at all.pdf",
        "2011-01-30 - GpCode Ransomware 2010 Simple Analysis.pdf",
        "2011-09-13 - Mebromi- the first BIOS rootkit in the wild.pdf",
        "Yara: HKTL_NATBypass_Dec22_1 ,  power_pe_injection ,  Mimikatz_Logfile",
        "2011-10-06 - ZeuS-in-the-Mobile \u2013 Facts and Theories.pdf",
        "Alleged APT Intrusion Set 1.php Group.pdf",
        "2011-03-11 - Trojan.Koredos Comes with an Unwelcomed Surprise.pdf",
        "2011-01-20 - Beschreibung des Virus Backdoor.Win32. Buterat.afj.pdf",
        "2011-10-26 - Tsunami Backdoor Can Be Used for Denial of Service Attacks.pdf",
        "2011-10-08 - Possible Governmental Backdoor Found (-Case R2D2-).pdf",
        "2011-09-02 - ZeuS Gets Another Update.pdf",
        "2011-04-19 - TDSS part 1- The x64 Dollar Question.pdf",
        "Palebot trojan.pdf",
        "Duqu Trojan Questions and Answers.pdf",
        "2011-03-08 - Worm-Win32-Yimfoca.A.pdf",
        "2011-07-14 - Cycbot- Ready to Ride.pdf",
        "The Nitro Attacks - Stealing secrets from the Chemical Industry.pdf",
        "2011-07-06 - Cybercriminals switch from MBR to NTFS.pdf",
        "2011-04-16 - Troj-Sasfis-O.pdf",
        "2011-09-27 - Debugging Injected Code with IDA Pro.pdf",
        "2011-10-13 - A Detailed Analysis of an Advanced Persistent Threat Malware.pdf",
        "2011-09-21 - Sept 21 Greedy Shylock - financial malware.pdf",
        "2011-06-22 - Criminals gain control over Mac with BackDoor.Olyx.pdf",
        "2011-08-24 - Ice IX, the first crimeware based on the leaked ZeuS sources.pdf",
        "2011-08-28 - Windows Remote Desktop Worm -Morto- Spreading.pdf",
        "2011-12-08 - The Sykipot Attacks.pdf",
        "Stuxnet , Duqu - The Evolution of Drivers.pdf",
        "Ghost RAT- Many faces.pdf",
        "The LURID Downloader.pdf",
        "2011-03-28 - Microsoft Hunting Rustock Controllers.pdf",
        "The RSA Hack.pdf",
        "2011-01-09 - Jan 6 CVE-2010-3333 DOC with info theft trojan from the American Chamber of Commerce.pdf",
        "2011-07-26 - SpyEye Trojan defeating online banking defenses.pdf",
        "2011-10-17 - W32-Yunsip!tr.pws.pdf",
        "2011-06-29 - Inside a Back Door Attack.pdf",
        "2011-09-09 - Stuxnet Malware Analysis Paper.pdf"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Ver",
            "Backdoor:asp/chopper.f!dha",
            "Php.exploit.c99-27",
            "Legacy.trojan.agent-37025"
          ],
          "industries": [],
          "unique_indicators": 6781
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/hispasec.com",
    "whois": "http://whois.domaintools.com/hispasec.com",
    "domain": "hispasec.com",
    "hostname": "blog.hispasec.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "69f47e886aac3dce3a958d27",
      "name": "2011: Malware Analysis Report",
      "description": "",
      "modified": "2026-05-01T10:20:56.666000",
      "created": "2026-05-01T10:20:56.666000",
      "tags": [],
      "references": [
        "2011-03-11 - Trojan.Koredos Comes with an Unwelcomed Surprise.pdf",
        "2011-01-20 - Beschreibung des Virus Backdoor.Win32. Buterat.afj.pdf",
        "2011-03-08 - Worm-Win32-Yimfoca.A.pdf",
        "2011-03-02 - TDL4 and Glupteba- Piggyback PiggyBugs.pdf",
        "2011-04-26 - SpyEye Targets Opera, Google Chrome Users.pdf",
        "2011-03-28 - Microsoft Hunting Rustock Controllers.pdf",
        "2011-01-09 - Jan 6 CVE-2010-3333 DOC with info theft trojan from the American Chamber of Commerce.pdf",
        "2011-04-19 - TDSS part 1- The x64 Dollar Question.pdf",
        "2011-04-16 - Troj-Sasfis-O.pdf",
        "2011-05-19 - Win32-Expiro.pdf",
        "2011-06-22 - Criminals gain control over Mac with BackDoor.Olyx.pdf",
        "2011-04-30 - BKA-Trojaner (Ransomware).pdf",
        "2011-06-29 - Inside a Back Door Attack.pdf",
        "2011-07-26 - SpyEye Trojan defeating online banking defenses.pdf",
        "2011-04-28 - Un observateur d\u2019\u00e9v\u00e9nements aveugle\u2026.pdf",
        "2011-07-08 - Trojan.Mayachok.2- ?????? ??????? ?????????? VBR-???????.pdf",
        "2011-07-14 - Cycbot- Ready to Ride.pdf",
        "2011-07-06 - Cybercriminals switch from MBR to NTFS.pdf",
        "2011-07-28 - Trojan Tricks Victims Into Transferring Funds.pdf",
        "2011-08-27 - Morto.A.pdf",
        "2011-01-30 - GpCode Ransomware 2010 Simple Analysis.pdf",
        "2011-08-03 - HTran and the Advanced Persistent Threat.pdf",
        "2011-08-28 - Windows Remote Desktop Worm -Morto- Spreading.pdf",
        "2011-09-09 - BIOS Threat is Showing up Again!.pdf",
        "2011-09-02 - ZeuS Gets Another Update.pdf",
        "2011-08-24 - Ice IX, the first crimeware based on the leaked ZeuS sources.pdf",
        "2011-09-13 - Mebromi- the first BIOS rootkit in the wild.pdf",
        "2011-08-04 - Analysis of ngrBot.pdf",
        "2011-09-14 - Ice IX- not cool at all.pdf",
        "2011-09-14 - Malware burrows deep into computer BIOS to escape AV.pdf",
        "2011-09-19 - Mebromi BIOS rootkit affecting Award BIOS (aka -BMW- virus).pdf",
        "2011-08-28 - Windows Remote Desktop Worm -Morto- Spreading22.pdf",
        "2011-09-21 - Sept 21 Greedy Shylock - financial malware.pdf",
        "2011-09-09 - Stuxnet Malware Analysis Paper.pdf",
        "2011-09-27 - Debugging Injected Code with IDA Pro.pdf",
        "2011-10-07 - Rustock samples and analysis links. Rustock.C, E, I, J and other variants.pdf",
        "2011-10-14 - A Detailed Analysis of an Advanced Persistent Threat Malware.pdf",
        "2011-10-06 - ZeuS-in-the-Mobile \u2013 Facts and Theories.pdf",
        "2011-10-08 - Possible Governmental Backdoor Found (-Case R2D2-).pdf",
        "2011-10-17 - W32-Yunsip!tr.pws.pdf",
        "2011-10-06 - Sep 28 CVE-2010-3333 Manuscript with Taidoor (Trojan.Matryoshka by CyberESI).pdf",
        "2011-10-13 - A Detailed Analysis of an Advanced Persistent Threat Malware.pdf",
        "2011-10-31 - The Significance of the -Nitro- Attacks.pdf",
        "2011-10-26 - Tsunami Backdoor Can Be Used for Denial of Service Attacks.pdf",
        "2011-12-20 - Analyzing CVE-2011-4369 \u2013 Part One.pdf",
        "2011-12-08 - The Sykipot Attacks.pdf",
        "2011-12-11 - Intro. To Reversing - W32Pinkslipbot.pdf",
        "Duqu Trojan Questions and Answers.pdf",
        "Palebot trojan.pdf",
        "HTran.pdf",
        "Ghost RAT- Many faces.pdf",
        "Operation Shady Rat.pdf",
        "Alleged APT Intrusion Set 1.php Group.pdf",
        "Stuxnet , Duqu - The Evolution of Drivers.pdf",
        "The RSA Hack.pdf",
        "The Nitro Attacks - Stealing secrets from the Chemical Industry.pdf",
        "Global_Energy_Cyberattacks_-_Night_Dragon_.pdf",
        "The LURID Downloader.pdf"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "kikinumpav",
        "id": "385742",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1031,
        "domain": 435,
        "CVE": 13,
        "FileHash-MD5": 155,
        "FileHash-SHA1": 8,
        "FileHash-SHA256": 234,
        "IPv4": 88,
        "email": 9,
        "hostname": 1031
      },
      "indicator_count": 3004,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 12,
      "modified_text": "29 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68d3caa9524bb6b5460615f3",
      "name": "Legacy.Trojan affects threat researchers networks & portals and/or  platforms",
      "description": "Legacy.Trojan affects threat researchers networks & portals and/or platforms or via platforms as a medium.\n[otx auto populated: Adversaries may be able to gain access to a victim's network through a range of techniques, as well as using a variety of other techniques to evade detection and detection.]\n#honeypot #capture #advesaries #fireeye #github",
      "modified": "2025-10-24T10:01:25.310000",
      "created": "2025-09-24T10:40:40.987000",
      "tags": [
        "text drag",
        "browse to",
        "select file",
        "or drop",
        "yara detections",
        "runlevel",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "inject",
        "stncphpphp more",
        "virustotal api",
        "comments",
        "related tags",
        "passive dns",
        "republic",
        "ipv4 add",
        "location korea",
        "korea",
        "asn as9318",
        "dns resolutions",
        "pulses otx",
        "close",
        "dynamicloader",
        "backdoor",
        "tgt session",
        "reads",
        "dynamic",
        "write",
        "chopper",
        "pho exploit",
        "backdoor",
        "fireeye",
        "low risk",
        "drop",
        "create snapshot",
        "hangover_appinbot",
        "kns dropper",
        "self",
        "md5 sha256",
        "google safe",
        "browsing",
        "server response",
        "response code",
        "vary",
        "mimikatz",
        "silence malware",
        "trojanagent",
        "legacy",
        "password",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "initial access",
        "defense evasion",
        "spawns",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "selection",
        "ascii text",
        "crlf line",
        "windir",
        "openurl c",
        "appearance code",
        "password",
        "urlhttps",
        "username",
        "flag",
        "united",
        "markmonitor",
        "github",
        "server",
        "date",
        "click",
        "apt 1",
        "high",
        "read c",
        "search",
        "medium",
        "show",
        "windows",
        "cmd c",
        "ms windows",
        "next",
        "copy",
        "ver",
        "businesseconomy"
      ],
      "references": [
        "Files",
        "Yara : KINS_dropper ,  apt_win_mutex_apt1 ,  Hangover_Fuddol ,   Hangover_Tymtin_Degrab",
        "Yara:  Hangover_Smackdown_various ,  Hangover_Foler  ,  Hangover_UpdateEx ,",
        "Yara: Hangover_Smackdown_Downloader ,  Hangover_Vacrhan_Downloader",
        "Yara: HKTL_NATBypass_Dec22_1 ,  power_pe_injection ,  Mimikatz_Logfile",
        "Yara: Mimikatz_Strings ,  Silence_malware_2 ,  EquationGroup_elgingamble ,  EquationGroup_cmsd",
        "Yara: EquationGroup_ebbshave ,  EquationGroup_eggbasket ,  EquationGroup_sambal",
        "Yara: Mimikatz_Logfile SID : * NTLM : Authentication Id : wdigest : Mimikatz_Strings sekurlsa::logonpasswords"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Ireland"
      ],
      "malware_families": [
        {
          "id": "Php.Exploit.C99-27",
          "display_name": "Php.Exploit.C99-27",
          "target": null
        },
        {
          "id": "Backdoor:ASP/Chopper.F!dha",
          "display_name": "Backdoor:ASP/Chopper.F!dha",
          "target": "/malware/Backdoor:ASP/Chopper.F!dha"
        },
        {
          "id": "Legacy.Trojan.Agent-37025",
          "display_name": "Legacy.Trojan.Agent-37025",
          "target": null
        },
        {
          "id": "Ver",
          "display_name": "Ver",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1110.001",
          "name": "Password Guessing",
          "display_name": "T1110.001 - Password Guessing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1459",
          "name": "Device Unlock Code Guessing or Brute Force",
          "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 87,
        "FileHash-SHA1": 84,
        "FileHash-SHA256": 1049,
        "URL": 1688,
        "hostname": 544,
        "email": 5,
        "domain": 292,
        "CVE": 2
      },
      "indicator_count": 3751,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "218 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://blog.hispasec.com/virustotal/rss20.xml",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://blog.hispasec.com/virustotal/rss20.xml",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780210863.5384214
}